April 2004 - syslog-ng - lists.balabit.hu

syslog-ng + stunnel
by lbw＠free.fr 15 Apr '04

15 Apr '04

hello, i am trying to securize the transmission of logs to my server via stunnel. syslog-ng without stunnel goes on but if i run stunnel it returns an error "connecting fd 6 to inetadr 127.0.0.1, port 514" when syslog-ng tries to send logs. i try the way described at http://www.stunnel.org/examples/syslog-ng.html and i also try to change the number of the port to no avail (i don't have firewall which could deny the connection). In fact, i wonder if stunnel may run as a demon because when i make "#stunnel /etc/stunnel/stunnel.conf" as it's said, "#ps aux" don't show it. Is it normal? so, i think my error of connection comes from the fact that nothing is listening on port 514 (i have try to connect on it via telnet and obtained "connection refused"). how can i check if stunnel is well running? --- configuration of the client: #syslog-ng destination stunnel { tcp("127.0.0.1" port(514)); }; #stunnel client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 10.1.1.200:5140 --- any suggestions? thanks, olivier

1 0

Moving from syslog -> syslog-ng - not logging
by Mark Robinson 15 Apr '04

15 Apr '04

I'm trying to move to syslog-ng but I can't get anything other than system messages to write to the log. Here's the syslog.conf file that woks: -------------------------------------------------------------------------------- *.err;kern.notice;auth.notice /dev/console *.err;kern.debug;daemon.info;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) ifdef(`LOGHOST', , *.err /var/adm/messages user.err /dev/console user.err /var/adm/messages user.alert `root, operator' user.emerg * ) local7.debug /data1/syslogs/nd.log auth.debug /data1/syslogs/nd.log local3.err /data1/syslogs/nd.log *.err;*.debug;*.crit;*.warning;*.info;*.notice /data1/syslogs/mcs.log local2.notice @sudosyslog.ca.company.com -------------------------------------------------------------------------------- How should a very basic syslog-ng.conf file be written? _________________________________________________________________ STOP MORE SPAM with the MSN Premium and get 2 months FREE* http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht…

1 0

Config file parsing inconsistencies
by John Kristoff 15 Apr '04

15 Apr '04

I seem to have discovered some discrepancies in the parsing of config file statements. I'm using syslog-ng 1.6.2. For example, the following: destination test { udp("10.0.0.1" port(514) localport(0)); }; results in a segfault upon startup, whereas the following: destination test { udp("10.0.0.1" port(514) localport("0")); }; works fine. I haven't gone searching through the code yet, but it seems that parsing of options is inconsisent (note 514 is not in quotes). A brief grep of some source files seems to suggest that there might be a inconsistencies on when to parse the option as a number versus a string. John

2 1

syslog-ng-announce mailing list ?
by José Pedro Oliveira 15 Apr '04

15 Apr '04

Hi, In the past message https://lists.balabit.hu/pipermail/syslog-ng/2004-January/005701.html there is a reference to the creation of a syslog-ng announcement list. Does it exists? At least it isn't mentioned in the following web pages: http://www.balabit.com/products/syslog-ng/ https://lists.balabit.hu/mailman/listinfo/ Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

8 8

$MSG contains $PROGRAM
by Loic Minier 14 Apr '04

14 Apr '04

Hey, When expanding the template macro $MSG, it will result in "program: message" when a program part is present. I think this shouldn't be. It is easy to fix with attached patch (remove a couple of lines at the end of parse_msg in log.c). Regards, -- Loïc Minier <lool(a)dooz.org>

1 1

syslog-ng email alerts
by Agnelo dsouza 13 Apr '04

13 Apr '04

Hi, I've configured syslog-ng for receiving alerts from remote system( /var/log/messages). I've configured 2 destinations 1. A file snort.log , i'm getting alerts in this file 2. email alerts, i'm unable to receive email alerts I've tested the script alert_mail.sh externally and it works.(i'm able to get mails, so sendmail is working) can someone help in solving this problem. Regards, Agnelo syslog-ng.conf ================== source sensors { internal(); tcp(ip(10.0.41.175) port(514) max-connections(7)); unix-stream("/dev/log"); }; destination localhost { file("/var/log/snort.log"); }; destination email_alert_script {program ("/usr/local/bin/alert_mail.sh"); }; log { source(sensors); destination(localhost); }; log {source(sensors); destination(email_alert_script); }; ========================== alert_mail.sh ==================== #!/bin/sh while read line; do echo $line |mail -s "Snort Alert" idsalert(a)xxxx.com done --------------------------------- Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway - Enter today

2 1

Scaling for a central loghost ?
by Michael Arndt 13 Apr '04

13 Apr '04

Hello *, Question: does syslog-ng scale well on a central syslog_Server collecting messages from about 200 unix hosts ? I have read old threads about this issue and found infos about a fixed bug and mention about one list member planning measurements with respect to scaling / message dropping. I am still a bit insecure: Can the receive buffer in syslog-ng made large enough to handle incomming syslog messages from about 200 hosts without dropping messages ? Can i take measures on client side (syslog-ng sender to avoid that sent informations are dropped either client side or server side) TIA Micha

3 2

Syslog-ng snapshots
by José Pedro Oliveira 13 Apr '04

13 Apr '04

Hi, The syslog-ng snapshots aren't being created any more. Is it possible to start generating them again? Snapshots location: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

2 1

hostname is replaced by the relay server's name
by Rich Armstrong 06 Apr '04

06 Apr '04

I have two logging servers. One is logging data from lots of clients, using syslog-ng 1.6.0rc3 - lets call that Host1. I want to forward the data via tcp/udp to the other host as well - lets call that Host2 using 1.6.2. At the moment, the $HOST field in data logged on Host2 contains Host1, instead of Client1, or Client2, etc. On both Host1 and Host2, I have set :- options { use_fqdn(yes); keep_hostname(yes); }; but the $HOST variable (in the destination variable, and in the message) on Host2 is still being replaced, so I line I know is from Client1, appears to come from Host1. Host1 transfers data to Host2 using :- destination d_netmon { udp("195.215.3.7"); }; log { source(net); destination(d_netmon); }; Am I using the wrong version of syslog-ng ? It seems that many on the list have had this problem before, and used keep_hostname(yes) to fix it. Is this a bug in the latest version ? -- Richard Armstrong

1 0

RE: [syslog-ng]remote log server
by Schernau, Ed 06 Apr '04

06 Apr '04

http://www.campin.net/syslog-ng/faq.html -----Original Message----- From: Rick S. [mailto:rsheppar@midnight.ecet.vtc.edu] Sent: Thursday, April 01, 2004 10:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]remote log server What do I need to put in the .conf file to have the logs sent over the net work to another machine? Rick S. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ----------------------------------------- Use of email is inherently insecure. Confidential information, including account information, and personally identifiable information, should not be transmitted via email, or email attachment. In no event shall Citizens or any of its affiliates accept any responsibility for the loss, use or misuse of any information including confidential information, which is sent to Citizens or its affiliates via email, or email attachment. Citizens does not guarantee the accuracy of any email or email attachment, that an email will be received by Citizens or that Citizens will respond to any email. This email message is confidential and/or privileged. It is to be used by the intended recipient only. Use of the information contained in this email by anyone other than the intended recipient is strictly prohibited. If you have received this message in error, please notify the sender immediately and promptly destroy any record of this email.

2 1